An organization is collaborating with an external vendor consultant on a cloud project. An administrator needs to configure access to company resources while satisfying the following security and operational requirements: The consultant must be able to sign in using their existing external corporate email account. The consultant must be required to complete multifactor authentication (MFA) when accessing corporate applications to maintain organizational compliance. The administrator must manage access permissions directly from the directory without creating and maintaining a separate internal password for the consultant. Which solution should the administrator implement?

Invite the consultant as a B2B guest user in Microsoft Entra ID and assign a Conditional Access policy requiring multifactor authentication.: ### What B2B External Identities and Conditional Access Are **Microsoft Entra External ID (B2B collaboration)** is a capability that allows organizations to securely share applications and resources with external users, such as vendors, partners, and contractors. **Conditional Access** is an identity-driven policy engine that evaluates real-time signals—such as user location, group membership, and risk level—to enforce access controls like **multifactor authentication (MFA)** or session restrictions. ### How It Meets the Requirements - **External Account Sign-In**: When an administrator invites an external user via B2B collaboration, the guest signs in using their existing **external work identity**, school account, or social identity without needing a separate local credential. - **Enforced MFA Compliance**: A **Conditional Access policy** can be specifically scoped to **Guest or external users**, requiring them to complete an MFA challenge when accessing targeted cloud applications. - **Simplified Administration**: Permissions and **role-based access control (RBAC)** are assigned directly to the guest object in the resource tenant while identity lifecycle and password management remain with the user's home identity provider. ### Key Advantages and Capabilities - **Seamless Onboarding**: Administrators can invite guests directly through the admin center using an **email address** and personalized message. - **Predictable Resource Protection**: The resource tenant enforces its own security standards, ensuring organizational compliance regardless of external partner setup. - **Granular Access Control**: Permissions can be assigned to directory roles, security groups, or individual Azure resources. - **Policy Simulation**: Administrators can utilize the **What If tool** to test and validate Conditional Access behavior prior to active enforcement. ### Why This Is Optimal This approach eliminates administrative overhead by avoiding duplicate credentials while ensuring strict compliance with corporate security standards through automated **Conditional Access enforcement**.